CVE-2026-22355
Published: 22 January 2026
Summary
CVE-2026-22355 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-22355 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the gregmolnar Simple XML Sitemap WordPress plugin (simple-xml-sitemap). The flaw enables Stored Cross-Site Scripting (XSS) and affects all versions from n/a through 1.3 inclusive. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
Attackers can exploit this vulnerability without authentication by crafting a malicious webpage that, when visited by a site administrator or other authenticated user, triggers a CSRF request to the plugin. This injects a Stored XSS payload, which executes in the context of the WordPress site for subsequent visitors or admins, potentially leading to session hijacking, data theft, or further site compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simple-xml-sitemap/vulnerability/wordpress-simple-xml-sitemap-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-Stored XSS issue specifically in plugin version 1.3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3878
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.This issue affects Simple XML Sitemap: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF enables unauthenticated injection of stored XSS payload into public-facing WordPress plugin (T1190); XSS directly facilitates arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of all plugin inputs to block the Stored XSS payload that the CSRF request attempts to persist.
Requires every state-changing request to the plugin endpoint to carry a valid, unforgeable token or origin check, directly stopping the unauthenticated CSRF vector.
Verifies integrity of stored sitemap data and plugin output, enabling detection of unauthorized script injection after a successful CSRF-to-XSS exploit.